CVE-2026-91713: Google Chrome vulnerability

Q: What must an attacker achieve before this issue can be exploited?

The attacker must first compromise the Chrome renderer process. After that, they can use a crafted HTML page to spoof UI elements.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.47 are affected.

Q: What is the practical impact of successful exploitation?

A compromised renderer process can spoof browser UI elements, which could make attacker-controlled page content appear to be trusted browser interface.

Published Sep 15, 2026

Updated

Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.47

Event History

Sep 15, 2026

CVE Published

via MITRE·08:41 PM

Data Sourced

via MITRE·08:41 PM

DescriptionWeakness

Frequently Asked Questions

What must an attacker achieve before this issue can be exploited?

The attacker must first compromise the Chrome renderer process. After that, they can use a crafted HTML page to spoof UI elements.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.47 are affected.

What is the practical impact of successful exploitation?

A compromised renderer process can spoof browser UI elements, which could make attacker-controlled page content appear to be trusted browser interface.